Hacer conocer el presente informe a otros investigadores y colectivos de docentes, con el fin de implementar y/o mejorar esta propuesta de

In this section, we describe the structure of directed paths in weakly 2-connected networks and deduce that messages can be secretly transmitted from each player to the designer. These results are building blocks for the proofs of our main theorems.

Throughout, all networks (directed graphs) are assumed to be acyclic, strongly 1-connected and weakly 2-1-connected. Given a (directed) network N , we denote N^u the associated undirected network: ij ∈ N^u if and only if ij ∈ N or ji ∈ N .

Our definition of weakly 2-connected networks is closely related to the definition of 2-connectedness for undirected graphs. An undirected graph is 2-connected if for each pair of distinct vertices i and j, there are two disjoint paths from i to j. There are several equivalent statements for 2-connectedness of undirected graphs and the reader is referred to Bollob`as (1998, Chap. III.2). For instance, define a cut-vertex as a vertex i such that deleting i and all its adjacent edges yields a disconnected graph.

The graph is 2-connected if and only if there is no cut-vertex. Equivalently, for each distinct vertices i, j and k, there is a path from i to j that does not contain k.

In our model, the designer (player 0) plays a special role, so that the network N is weakly 2-connected if and only if no player i ∈ N is a cut-vertex of N^u. The designer, however, can be a cut-vertex. In such case, let a block be a maximal 2-connected subgraph of N^u. The undirected network N^u is a collection of blocks attached at 0.

See Figure 9 for an example. In the sequel, we assume for simplicity that N^u is the only block, so that N^u is 2-connected. (If there are several blocks, all our arguments remain valid block-by-block.)

In the sequel, we use the letters a, b, etc. to denote nodes (players) in the network.

This must not be confused with alternatives.

We define a loop, denoted L(a, b), in N as a pair of directed paths with same origin a and end-point b, and no vertex in common except for the origin a and the end-point b. The loop L(a2, b2) is a successor of the loop L(a1, b1) if a2 ∈ L(a/ ₁, b1), b2 ∈ L(a/ ₁, b1) and the intersection L(a1, b1) ∩ L(a2, b2) is a path which contains at least one edge and the vertex b1. See Figure 10 for an example.

0

Figure 9: Blocks attached at 0

a1

a2

b1

b2

Figure 10: L(a2, b2) is a successor of L(a1, b1)

We use the following notation: we write i → k for a directed path (i₀ = i, i₂, . . . , iR = k) from player i to player k and i → k → l for a directed path from i to l through k, etc. We say that two directed paths (i0 = i, i2, . . . , iR) and (j0 = i, j2, . . . , jQ) cross each other if there exist r^∗ and q^∗ such that jq^∗ = ir^∗.

To prove our main results, we use the following decomposition of directed graphs into successive loops. We assume that there are at least three player (if n = 2, the only strongly 1-connected and weakly 2-connected network is such that D(0) = N).

Proposition 2 Let n ≥ 3. For each i ∈ N\D(0) and each j ∈ C(i), there exists a finite sequence of loops L(a1, b1), . . . , L(aM, bM) such that:

1. the edge ij belongs to L(a1, b1),

2. for each m = 1, . . . , M − 1, L(a_m+1, b_m+1) is a successor of L(am, bm) and a_m+1 ∈/

∪q≤mL(aq, bq), and 3. bM = 0.

a1

i a2

a3 b1

b2

a4

b4 = 0 b3

Figure 11: A sequence of loops

Proof This is trivially true if n = 3. Assume that n ≥ 4. The proof rests on several lemmatas.

Lemma 3 Let N^u be a 2-connected undirected graph. Let A be a non-empty set of vertices and let b and c two distinct vertices that do not belong to A. There exists a^∗ ∈ A and a path from a^∗ to c that has no vertex in (A\{a^∗}) ∪ {b}.

Proof. Since N^u is 2-connected, for each a ∈ A, there exists a path from a to c that does not contain b (otherwise, b would be a cut-vertex). This path must leave the set A to reach c, thus the last point a^∗ in A on this path has the desired properties. • Lemma 4 Let i ∈ N\D(0) and j ∈ C(i), there exists a loop that contains the edge ij.

Proof. Remember that for each player k ∈ N, there exists a directed path from k to 0 by strong 1-connectedness and thus, C(k) 6= ∅. Consider a player i ∈ N\D(0) and j ∈ C(i).

• Case 1. If C(i) contains another player k 6= j, then there exists a directed path from i to 0 through the edge ij and a directed path from i to 0 through the edge

ik. These paths must cross each other (possibly at 0), thus we have found the desired loop.

• Case 2. If C(i) = {j}, denote D_∞(i) the set of players who have a directed path to i. From Lemma 3, there exists k ∈ D∞(i) and an undirected path (k0 = k, k1, . . . , kR = 0) from k to 0 such that no player kr is in D∞(i) ∪ {i}

for r > 0. If the edge kk1 is directed from k to k1, then choose a directed path from k1 to 0 to obtain the directed path k → k1 → 0 one the one hand and the directed path k → i → j → 0 on the other hand. These paths must cross each other and therefore, define a loop with origin k. (The first crossing point defines the end-point of the loop.) The end-point of the loop cannot be in D∞(i) ∪ {i}

since k1 ∈ D/ ∞(i). It follows that the edge ij is contained in this loop.

If the edge kk1is directed from k1to k, then we progress along the path (k1, . . . , kR) until we reach a first edge krkr+1 directed from kr to kr+1. Such an edge exists since, thanks to acyclicity, the edge kR−10 is directed from kR−1 to 0. Thus, there exists a directed path from kr+1 to 0. Consider then the directed path kr→ k_r+1 → 0 one the one hand and the directed path kr→ k → i → j → 0 on the other. These paths must cross each other and thus define a loop with origin kr. Again, the end-point of the loop cannot be in D∞(i) ∪ {i} since kr ∈ D/ _∞(i).

It follows that the edge ij is contained in this loop.

• We now construct the desired sequence of loops. We start with i ∈ N\D(0) and j ∈ C(i).

First step. Let L(a1, b1) be a loop containing ij and such that t(b1) is maximal among all loops that contain ij (t(·) is the timing function constructed in Lemma 1).

(Such a loop exists by the above lemma.) If b₁ = 0, the construction ends. If b₁ 6= 0, let c₁ ∈ C(b₁) and denote d₁ and e₁ the two predecessors of b₁ on each path of L(a₁, b₁).

The construction then proceeds inductively. Assume that L(a1, b1), . . . , L(aM, bM) have been constructed for some M ≥ 1. If bM = 0, the construction ends. If bM 6= 0, let cM ∈ C(b_M) and denote dM and eM the two predecessors of bM on each of the two disjoint directed paths of L(aM, bM).

For each subset of players N^′, let us denote D∞(N^′) the set of players j for whom there exists a directed path from j to some player in N^′. Clearly, D∞(N^′ ∪ N^′′) = D∞(N^′) ∪ D∞(N^′′) and D∞(D∞(N^′)) = D∞(N^′).

Lemma 5 There exists a loop L(aM+1, bM+1) such that aM+1 ∈ ∪/ _q≤ML(aq, bq) ∪ D∞(i) and which contains either the path dM → b_M → c_M or the path eM → b_M → c_M. Furthermore, this loop is disjoint from ∪q≤M −1D∞(L(aq, bq)) ∪ D∞(i).

Proof. From Lemma 3, there exists uM ∈ ∪q≤MD∞(L(aq, bq))∪D∞(i) and an undirected path (λ0 = uM, λ1, . . . , λS = 0) from uM to 0 disjoint from (∪q≤MD∞(L(aq, bq)) ∪ D∞(i) ∪ {bM})\{uM}. Assume that uM ∈ D∞(L(aM, bM)). There exists a directed path from uM to bM which goes either through dM or through eM. Without loss of generality, assume that this path goes through dM. If the edge uMλ1 is directed from uM to λ1, then choose a directed path from λ1 to 0 to obtain the directed path uM → λ1 → 0 on one hand and the directed path uM → dM → bM → cM → 0 on the other hand. These paths must cross each other and therefore, define a loop with origin uM. Since λ1 ∈ ∪/ q≤MD∞(L(aq, bq)) ∪ D∞(i), the path λ1 → 0 cannot go through ∪q≤MD∞(L(aq, bq)) ∪ D∞(i), and thus the end-point of the loop is not in

∪_q≤MD∞(L(aq, bq)) ∪ D∞(i) either. The path dM → bM → cM is thus contained in the new loop.

If the edge uMλ1 is directed from λ1 to uM, then we progress along the path (λ1, . . . , λS) until we reach a first edge λsλs+1 directed from λs to λs+1. There must exists one such edge, because of the acyclicity of N . Then, there is a directed path from λs+1 to 0. Consider the directed path λs → λ_s+1 → 0 one one hand, and the directed path λs → uM → dM → bM → cM → 0 on the other. These paths must cross each other and thus define a loop with origin λs. As before, the end-point of the loop is not in ∪q≤MD∞(L(aq, bq)) ∪ D∞(i), thus the path dM → bM → cM is contained in this loop.

Finally, uM cannot be in ∪q≤M −1D∞(L(aq, bq))∪D∞(i). Otherwise, the construction above provides a loop that would contradict the maximality property of bm, for some m < M. That is, since t(bM+1) > t(bm), the newly constructed loop would have been used at an earlier stage of the induction. Similarly, the origin aM+1 of the new loop

cannot be in ∪q≤MD∞(L(aq, bq)) ∪ D∞(i). •

Inductive step. Let L(aM+1, bM+1) be a loop containing dM → bM → cM or eM →

bM → cM and such that t(bM+1) is maximal among all loops that contain dM → bM → cM or eM → bM → cM. If bM+1 = 0, the construction ends and otherwise, continues inductively.

By construction, there is a directed path from bm to b_m+1, thus t(bm) < t(b_m+1) from the definition of the timing structure. It follows that the construction stops after a finite number of iterations. This completes the proof.  Proposition 2 is a building block for the construction of a protocol (mechanism and strategies) that allows player i to secretly send a message to the designer. Let us summarize our findings. Proposition 2 has the following implications: For each player i ∈ N \ D(0) and j ∈ C(i), there exists a finite sequence of loops (L(am, bm))^M_m=1 such that (i) ij ∈ L(a1, b1), (ii) bM = 0 and (iii) the loop L(am+1, bm+1) is a successor of the loop L(am, bm), m = 1, . . . , M − 1, with the additional property that there exists um ∈ L(am, bm)∩L(a_m+1, b_m+1) such that the directed path from um to bm in L(am, bm) is part of the directed path from um to bm+1 in L(am+1, bm+1). Moreover, the sequence of loops defines a directed path from player i to the designer through all players b1 to bM−1. To see this, note that player i belongs to the loop L(a1, b1) from player a1 to player b1 and thus, belongs to one directed path to b1. Similarly, b1 belongs to the loop L(a2, b2) and thus, has a directed path to b2. Iterating this argument, we construct a directed path from i to the designer through the players b₁ to bM−1. We will use this directed path to secretly transfer the private information of player i to the designer.

Proposition 3 Let v be a random variable in [0, 1) privately known to player i. There exists a protocol Mi (i.e., a mechanism and a profile of strategies) on N such that whenever all players follow the prescribed strategies, the designer correctly learns the value of v. Moreover, the messages received by any player j 6= i are probabilistically independent from v.

Proof If i ∈ D(0), this is straightforward. Fix i ∈ N\D(0) and consider the sequence of loops constructed in Proposition 2. We divide players into several categories.

- A player who belongs to one loop is active. All other players are inactive. Inactive players do not send or receive messages (their message sets are singletons). Let us focus now on active players.

- A player am who is the origin of a loop is a provider.

- A player bm who is the end-point of a loop is a lock-opener.

- The player um who is the first point on the intersection of the two successive loops L(am, bm) and L(am+1, bm+1) is a lock-closer.

- Other active players are transmitters.

By construction, note that a provider has no active predecessor and exactly two active successors. A lock-opener, or a lock-closer, has two active predecessors and one active successor. Transmitters have exactly one active predecessor and one active successor. Finally, player i is either a transmitter or a provider. For each loop, we label Left (L) the path that contains the lock-closer and Right (R) the other. The strategies for active players other than player i are as follows:

• Each transmitter truthfully forwards the message received from his active prede-cessor to his active sucprede-cessor.

• Each provider am draws an encryption key Xm uniformly in [0, 1) and sends it to its two active successors.

• Each lock-closer umreceives two numbers xm and xm+1 from his two predecessors.

He computes zm = xm⊕ x_m+1 and sends zm to his active successor. Remark that there is no lock-closer uM+1 in the last loop L(aM, bM).

• Each lock-opener bm (with m < M) receives two numbers x^L_m and x^R_m from his left and right predecessors. He computes wm = x^L_m ⊖ x^R_m and sends wm to his active successor.

Player i’s strategy is as follows:

• If he is a transmitter, player i receives x1 from his active predecessor and sends x₁ ⊕ v to his active successor.

• If he is a provider, player i sends X₁⊕ v to his active successor on the left path and X1 to his active successor on the right path.

See Figure 12 for a heuristic illustration of the strategies.

Firstly, we show that this protocol allows the designer to correctly learn the value of v. To this end, let us assume that these strategies are effectively played and compute the messages wm sent by the lock-openers.

a1 draws X1

a2 draws X2

a3 draws X3 ⊖ b1

⊖ b2

a4 draws X4

0 = b4

b3 ⊖

i: X₁⊕ v

⊕ u1

⊕ u4⊕

⊖

Figure 12: Providers, lock-closers ⊕ and lock-openers ⊖

The sequence of loops defines a directed path from player i to the designer. This path contains all lock-openers (bm) and some lock-closers (um) and is uniquely defined if player i is a transmitter. If player i is a provider, we choose the only such path that begins with the left path of the first loop. Along this path, let us attach labels to players. All lock-openers and player i are labeled ⊖ and the lock-closers are labeled ⊕.

For instance, in Figure 12, we have

i^⊖→ u^⊕₁ → b^⊖₁ → b^⊖₂ → u^⊕₄ → b^⊖₃ → b^⊖₄ = 0.

This induces a sequence in the alphabet {⊖, ⊕}. Let ν(bm) be the number of occurrence of two consecutive ⊖ appearing in the sequence before bm (including bm). For instance, in the example above, ν(b1) = 0, ν(b2) = ν(b3) = 1, ν(b4) = 2.

Lemma 6 If the players follow the above strategies, for each m = 1, . . . , M − 1, we have

wm = (−1)^ν(bm)v ⊕ Xm+1. The two messages received by the designer are XM and wM−1.

Consequently, the designer can compute the value v of the private information of player i, which is XM ⊖ wM−1 if ν(bM−1) is odd and wM−1⊖ XM if ν(bM−1) is even.

Proof. We first compute w1and then proceed by induction. Consider the loop L(a1, b1).

Player i is either on the left path of the loop L(a1, b1) or on the right path of L(a1, b1).

In the former case, the left path from i to b1 is i^⊖ → u^⊕₁ → b^⊖₁ and the right path is i → b1. Player b1 thus receives X2⊕ X1 ⊕ v from the left and X1 from the right. It follows that w1 = (X2⊕ X1⊕ v) ⊖ X1 = X2⊕ v. Note that in this case ν(b1) = 0. See Figure 13 for an illustration.

In the latter case, the left path is a1 → u₁ → b₁ and the right path is i^⊖ → b^⊖₁. Player b1 thus receives X2 ⊕ X₁ from the left and X1 ⊕ v from the right. Thus w₁ = (X2⊕ X₁) ⊖ (X1⊕ v) = X₂⊖ v. Note that in this case ν(b₁) = 1. See Figure 14 for an illustration. We have thus proved the lemma for m = 1.

⊖ i : X1⊕ v

a1 : X1

⊖

⊕ X₂

X₂⊕ X1⊕ v

X2⊕ X1⊕ v ⊖ X1

Figure 13: w1 with player i on the left path.

⊖ i : X₁⊕ v

a₁ : X₁

⊖

⊕ X₂

X₂⊕ X1

X₂⊕ X₁⊖ X₁⊖ v

Figure 14: w1 with player i on the right path.

We proceed now by induction. Let us assume that for some m ≤ M − 1, wm−1 = (−1)^ν(bm−1)v ⊕ Xm and compute wm. Consider the loop L(am, bm). By construction,

this loop contains bm−1 and um and the left path is the one that contains um. Thus, bm−1 is either on the left path or on the right path. In the former case, the left path of this loop is am → b^⊖_m−1 → u^⊕_m → b^⊖_m and the right path is am → b_m. Since there is also the path am+1 → um → bm, the message received by bm from the left is Xm+1⊕ (−1)^ν(bm−1)v ⊕ Xm and the message received from the right is Xm. Thus,

wm = (Xm+1⊕ (−1)^ν(bm−1)v ⊕ Xm) ⊖ Xm = Xm+1 ⊕ (−1)^ν(bm−1)v.

Remark that in this case ν(bm) = ν(bm−1). See Figure 15 for an illustration.

b^⊖_m−1: w_m−1 a_m: X_m

a_m+1: X_m+1 u^⊕_m

b^⊖_m b^⊖_m+1

Figure 15: wm with player bm−1 on the left path

In the former case, the left path is am → um → bm and the right path is am → b^⊖_m−1 → b^⊖_m. Since there is also the path am+1 → um → bm, the message received from the left is Xm+1⊕ Xm and the message received from the right is (−1)^ν(bm−1)v ⊕ Xm. Thus wm = (Xm+1 ⊕ Xm) ⊖ ((−1)^ν(bm−1)v) = Xm+1⊖ (−1)^ν(bm−1)v. Remark that in this case ν(bm) = ν(bm−1) + 1. See Figure 16 for an illustration.

Finally, consider the last loop L(aM, bM), where bM = 0 is the designer. By con-struction, this loop does not contain a lock-closer uM+1. One path of this loop goes through bM−1, i.e., we have aM → bM−1 → bM, and the other is aM → bM. Other players on this loop are transmitters. The designer thus receives wM−1 from the first path and XM from the other. The proof of the Lemma is thus complete. •

To complete the proof of Proposition 3, we argue that the message received by each player j 6= i is probabilistically independent from v. This is clearly true for inactive players and for providers. More generally, the only messages that depend on v are those on the directed path from player i to the designer as constructed above, so the

b^⊖_m−1 : wm−1

am : Xm

a_m+1 : X_m+1 um

b^⊖_m b^⊖_m+1

Figure 16: wm with player bm−1 on the right path

statement clearly holds for players outside of this path. Transmitters on this path receive messages of the type X ⊕ v where X is some random variable independent from v and uniformly distributed. From Lemma 2 (iii), this is independent from v. The very same reasoning holds for lock-closers. For lock-openers, this is a consequence of the above computation: since Xm and Xm+1 are independent and uniformly distributed,

so are the two messages received by bm. 

Corollary 1 Let (vi)i∈N be independent random variables such that vi is known to player i only. There exists a protocol M on N such that, whenever all players abide by the protocol, the designer correctly learns the value of each vi. Moreover, the messages received by any player j are probabilistically independent from (vi)i6=j.

Proof From Proposition 3, for each player i, there exists a protocol (mechanism and strategies) Mi such that player i can secretly transfer his private information vi to the designer without revealing information to the other players. The idea is then to concatenate all these protocols “in parallel.” That is, each player j plays a role in each Mi (inactive, provider, lock-closer, lock-opener or transmitter), and should play all the corresponding roles simultaneously. For instance, if he is transmitter in several Mi’s, he should forward the corresponding messages on the corresponding links. Moreover, if a player is a provider in one or several Mi’s, the random draws must be mutually

independent and independent of messages received.